ci: mark major dependabot bumps as breaking and run CI on merge groups

[jeswr]

What

• automerge.yml: use dependabot/fetch-metadata to inspect the semver level of each dependabot update instead of hand-parsing swipl-wasm versions out of package.json.
  • Major bumps of production npm dependencies now append a BREAKING CHANGE: footer to the PR body, so the squash commit triggers a semantic-release major. Previously a major bump such as swipl-wasm 7 -> 8 (fix!: bump swipl-wasm from 7.0.10 to 8.0.1 #1945) kept its fix: title and would ship as a patch; the old gh pr merge --subject "BREAKING CHANGE: ..." approach also put the note in the squash subject, which the angular commit parser cannot read (verified: it yields no release), and --subject/--body flags are ignored by merge queues anyway.
  • Minor swipl-wasm updates keep their feat: mapping (now via a PR retitle); patch bumps, dev-dependency bumps and github-actions bumps keep their current fix:/chore: behaviour.
  • The old flow checked out the PR head under pull_request_target; the new flow does not check out any code.
• nodejs.yml, codeql-analysis.yml: add merge_group: triggers so all required checks also run for merge-queue entries.

Why

semantic-release's default (angular) commit-analyzer treats a commit as a major only when a line of the commit body starts with BREAKING CHANGE:. It does not understand the type!: shorthand — verified against @semantic-release/commit-analyzer@13.0.1 as pinned in the lockfile, where fix!: ... produces no release at all.

Repository squash settings were switched to squash_merge_commit_title=PR_TITLE / squash_merge_commit_message=PR_BODY, so the PR title and body deterministically become the squash commit message (previously a single-commit PR used the commit's own message, ignoring PR title edits). This is what both the reworked automerge flow and the merge queue rely on.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[jeswr]

🎉 This PR is included in version 21.1.11 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release
• v21.1.11

Your semantic-release bot 📦🚀